BloodConq← Back

Folio · Legal

Privacy Policy

Last updated: 16 April 2026

01Controller

The controller responsible for the processing of personal data within the meaning of Regulation (EU) 2016/679 (the “GDPR”) and complementary national data-protection laws is:

[Full legal name / Sole trader name]
[Street and number]
[Postal code, city]
[Country]
Email: [privacy@bloodconq.example.com][GDPR Art. 4(7), 13(1)(a)]

02Data Protection Officer

Where mandatory under Article 37 GDPR or § 38 BDSG (in particular where 20 or more persons are constantly engaged in automated processing, or where large-scale processing of special-category data, or systematic monitoring of data subjects on a large scale, takes place):

[First and last name of the DPO]
Email: [dpo@bloodconq.example.com][GDPR Art. 37–39]

03Categories of Data, Purposes and Legal Bases

We process the following categories of personal data for the following purposes and on the legal bases stated. Each processing activity is accompanied by its statutory anchor for traceability.

3.1 Provision of the website (server logs)

When you access the website, technically necessary connection data are processed:

  • IP address
  • Date and time of the request
  • URL requested and HTTP status code
  • Browser and operating system identifier (user agent)
  • Referrer URL, where transmitted by your browser

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is the operation of a functional, secure service that is protected against abuse.

Retention: up to 7 days in unaggregated form (this includes the plain IP address stored with a sign-in session); thereafter aggregation or deletion.

3.2 Player account (sign-up and sign-in)

When you create an account, we process:

  • Email address
  • Username (publicly visible inside the game)
  • Display name (publicly visible inside the game)
  • Password — stored exclusively as a cryptographic hash, never in plaintext
  • Authentication token for session management
  • Account creation timestamp

Legal basis: Article 6(1)(b) GDPR (performance of contract — the user agreement is concluded only upon registration).

Retention: Until the account is deleted by the user or terminated for breach of the Terms of Service. Deletion within [30 days] thereafter, subject to statutory retention obligations.

3.3 Game state (villages, commands, reports)

All in-game actions are persisted server-side: position and development of your villages, commands you issue and receive (attacks, support), the resulting reports (battle outcome, losses), and clan membership.

Legal basis: Article 6(1)(b) GDPR. This processing is strictly necessary to provide the game service.

Retention: For the duration of the active world. Reports and command history are retained until the account is deleted.

3.4 Chat and clan communications

Messages in public lobby channels and in clan-internal channels are transmitted in real time and retained for a reasonable scrollback window ([14 days]). Reported messages may be retained longer for evidence preservation.

Legal basis: Article 6(1)(b) and (f) GDPR (performance of contract and our legitimate interest in functional moderation).

3.5 Reports and moderation actions (DSA Art. 16)

Notices we receive about allegedly illegal content, and the decisions we take in response (warning, suspension, removal), are documented for at least [6 months] for audit and appeal purposes.

Legal basis: Article 6(1)(c) GDPR in conjunction with Articles 16, 17 and 24 DSA.

3.6 Fair play, cheating and abuse prevention

To detect multi-account abuse, automated play and fraud, we keep an audit log of account and gameplay actions (for example sign-ins, troop movements, trades, purchases and chat messages) together with pseudonymised technical identifiers:

  • A keyed hash (HMAC) of your IP address and of its network (/24 for IPv4, /64 for IPv6) — the plain IP address is not stored in the audit log
  • A random device identifier issued by our server and stored in your browser
  • Browser identifier (user agent), timing of actions and their origin (manual or premium automation)

Several accounts on one connection or device are allowed. Such links only lead to a manual review by our moderators when the linked accounts interact (for example by sending each other resources); they never lead to an automatic block.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is a fair game for all players and the prevention of fraud with paid features.

Retention: 90 days. Records that form the evidence of a confirmed violation are kept until the related moderation case and any appeal are closed. When you delete your account, personal content in these records (such as message texts and email addresses) is erased.

3.7 Withdrawal of consent

Where processing is based on your consent under Article 6(1)(a) GDPR (none of the processing activities listed above currently relies on consent), you have the right to withdraw that consent at any time, with effect for the future.[GDPR Art. 7(3)]

04Cookies, Local Storage and Analytics

4.1 Strictly necessary storage

The following storage is strictly necessary to provide the service you have explicitly requested. No consent is required under § 25(2) Nr. 2 TTDSG (transposing Art. 5(3) of the ePrivacy Directive).

  • Session token (LocalStorage) — authentication token used to sign in to the game server. Lifetime: until logout or until the token is invalidated by the server.
  • theme (LocalStorage) — stores your colour-scheme preference (light / dark / system). Lifetime: until cleared by the user.
  • Phoenix channel cookie — session cookie of the realtime channel. Lifetime: browser session.
  • Consent preferences / notice dismissal (LocalStorage) — record your choice on the cookie notice so we do not re-prompt on every visit. Lifetime: until cleared by the user.

4.2 Analytics — only if configured for the deployment

Depending on the build, we may load one or both of the following analytics services. The cookie notice in the lower-right corner of every page reflects the current state of this deployment.

  • Plausible Analytics (only if NEXT_PUBLIC_PLAUSIBLE_DOMAIN is set) — privacy-respecting, cookie-less analytics. Plausible does not set identifiers on your device and does not process personally identifying information beyond a short-lived in-memory hash of IP + user-agent used to deduplicate page views. Operated under our legitimate interest in understanding traffic patterns. [GDPR Art. 6(1)(f)]
  • Microsoft Clarity (only if NEXT_PUBLIC_CLARITY_ID is set) — session-replay and heat-map tool. Clarity sets cookies and may record interactions on the page. Loaded only after you click “Accept” on the cookie notice and not before. Operated under your consent. [GDPR Art. 6(1)(a); TTDSG § 25(1)]

You can withdraw consent at any time by clearing the consent preferenceentry in your browser's storage; the cookie notice will reappear on the next page load and you can choose again. We are working on an in-account consent management page that will make this a one click action.

4.3 What we do not use

We do not use third-party advertising cookies, cross-site tracking, fingerprinting, social-media share buttons that load before interaction, or A/B-testing services that identify users.[TTDSG § 25; ePrivacy Dir. Art. 5(3)]

05Recipients and Processors

Personal data are disclosed only to the following categories of recipient. Where a recipient acts as a processor, processing takes place on the basis of a written agreement under Article 28 GDPR.

  • Hosting provider — [provider, place of establishment, DPA date]. Processor under Art. 28 GDPR.
  • Transactional email — [e.g. Postmark / Mailgun / own SMTP] for confirmation and security emails.
  • Moderation tooling: [currently none].

06International Transfers

Transfers of personal data to recipients in third countries (outside the EU/EEA) take place [not at all / only on the basis of EU Standard Contractual Clauses and supplementary measures]. Where transfers occur, you may obtain a copy of the safeguards in place by writing to the contact address in Section 1.[GDPR Arts. 44–49]

07Your Rights

You have, at any time, the following rights with respect to your personal data:

  • Right of access to the data we hold about you [GDPR Art. 15]
  • Right to rectification of inaccurate data [GDPR Art. 16]
  • Right to erasure (“right to be forgotten”) [GDPR Art. 17]
  • Right to restriction of processing [GDPR Art. 18]
  • Right to data portability in a structured, commonly-used, machine-readable format [GDPR Art. 20]
  • Right to object to processing based on Article 6(1)(e) or (f) [GDPR Art. 21]
  • Right to withdraw consent at any time, with effect for the future [GDPR Art. 7(3)]
  • Right to lodge a complaint with a supervisory authority, without prejudice to any other administrative or judicial remedy [GDPR Art. 77]

You can find your competent supervisory authority via the German Federal Commissioner's overview at bfdi.bund.de, or via the EU register of national authorities at edpb.europa.eu/members.

08Security of Processing

Transport between your browser and our servers is encrypted (HTTPS, TLS 1.2 or higher). Passwords are stored exclusively as hashes using a current industry-grade password-hashing function (see the server-side authentication service module). Authentication tokens are cryptographically random and are rotated automatically on suspicion of compromise. We employ appropriate technical and organisational measures within the meaning of Article 32 GDPR.[GDPR Arts. 5(1)(f), 32]

09Personal Data Breach Notification

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 GDPR. Notifications to the competent supervisory authority will be made within 72 hours where required.[GDPR Arts. 33, 34]

10Automated Decision-Making and Profiling

No automated decision-making within the meaning of Article 22 GDPR takes place. In-game calculations (battle outcome, travel time) are deterministic game mechanics and do not constitute profiling for the purposes of the GDPR.[GDPR Art. 22]

11Children

The service is not directed at children below the age of [16]. Where consent serves as a legal basis for processing in relation to information-society services offered directly to a child, the consent of the holder of parental responsibility is required for children below the age applicable in the relevant Member State (Art. 8 GDPR; in Germany: 16 years).[GDPR Art. 8]

12Changes to This Policy

We may update this Privacy Policy from time to time, in particular when the legal framework or the technologies we use change. Where changes are material to you, we will notify you via the email address on file.